Sign.proj

<!-- Licensed to the .NET Foundation under one or more agreements. The .NET Foundation licenses this file to you under the MIT license. -->
<Project DefaultTargets="Sign">

  <!--
    Documentation for publishing is available here:
      - https://github.com/dotnet/arcade/blob/master/Documentation/CorePackages/Signing.md
  
    Optional variables:
      EnableDefaultArtifacts            Includes *.nupkg, *.vsix and *.wixpack.zip under "/artifacts/packages/**" for signing.
                                        Defaults to true.
      EnableDefaultRidSpecificArtifacts Do not sign *.nupkg packages under "/artifacts/packages/**" that do not contain the current TargetRid.
      DefaultArtifactVisibility         The default visibility for Artifact items. Defaults to External.

    Optional items:
      Artifact (with Metadata)          Path to the artifact to publish. Declare the item in Signing.props to sign and publish the artifact.
        - SkipPublish                     If true, skips publishing the artifact.
  -->

  <PropertyGroup>
    <!-- Disable target framework filtering for top level projects -->
    <NoTargetFrameworkFiltering>true</NoTargetFrameworkFiltering>
  </PropertyGroup>

  <Import Project="BuildStep.props" />
  <Import Project="TargetFrameworkDefaults.props" />

  <Import Project="$(NuGetPackageRoot)microsoft.dotnet.signtool\$(MicrosoftDotNetSignToolVersion)\build\Microsoft.DotNet.SignTool.props" />

  <!-- Required to determine whether full assembly strong name signing is supported, which may affect selection of some certificates. -->
  <Import Project="StrongName.props" />
  <Import Project="Sign.props" />

  <!-- Import the wix props to get the install path -->
  <Import Project="$(NuGetPackageRoot)microsoft.signed.wix\$(MicrosoftSignedWixVersion)\build\Microsoft.Signed.Wix.props" />

  <!-- Update sign infos that were using Microsoft400 to use the .NET-specific cert if UseDotNetCertificate is present.
       This will update any use, even if explicitly specified.
       NOTE: This is outside the target on purpose, as Update will not correctly evaluate in the target. See
       https://github.com/dotnet/msbuild/issues/1618. -->
  <ItemGroup Condition="$(UseDotNetCertificate)">
    <FileExtensionSignInfo Update="@(FileExtensionSignInfo->WithMetadataValue('CertificateName','Microsoft400'))" CertificateName="$(DotNetCertificateName)" />
    <StrongNameSignInfo Update="@(StrongNameSignInfo->WithMetadataValue('CertificateName','Microsoft400'))" CertificateName="$(DotNetCertificateName)" />
    <FileSignInfo Update="@(FileSignInfo->WithMetadataValue('CertificateName','Microsoft400'))" CertificateName="$(DotNetCertificateName)" />
  </ItemGroup>

  <Target Name="Sign">
    <Error Text="The value of DotNetSignType is invalid: '$(DotNetSignType)'"
           Condition="'$(DotNetSignType)' != 'real' and '$(DotNetSignType)' != 'test' and '$(DotNetSignType)' != ''" />

    <PropertyGroup>
      <_DryRun>true</_DryRun>
      <!-- Allow an official build to force dry run signing. This allows the VMR's build to test signing in CI without changing versions. -->
      <_DryRun Condition="'$(OfficialBuild)' == 'true' and '$(ForceDryRunSigning)' != 'true'">false</_DryRun>

      <_TestSign>false</_TestSign>
      <_TestSign Condition="'$(DotNetSignType)' == 'test'">true</_TestSign>

      <_DotNetCoreRequired>false</_DotNetCoreRequired>
      <_DotNetCoreRequired Condition="'$(_DryRun)' != 'true'">true</_DotNetCoreRequired>

      <!-- SN is only available on Windows -->
      <SNBinaryPath Condition="$([MSBuild]::IsOSPlatform('Windows'))">$(NuGetPackageRoot)sn\$(SNVersion)\sn.exe</SNBinaryPath>
      
      <!-- .pkgs and .app bundle tooling is only available on MacOS -->
      <PkgToolPath Condition="$([MSBuild]::IsOSPlatform('OSX'))">$(NuGetPackageRoot)microsoft.dotnet.macospkg.cli\$(MicrosoftDotNetMacOsPkgVersion)\tools\$(NetToolCurrent)\any\Microsoft.Dotnet.MacOsPkg.Cli.dll</PkgToolPath>
    </PropertyGroup>

    <Error Condition="'$(AllowEmptySignList)' != 'true' AND '@(ItemsToSign)' == ''" 
           Text="List of files to sign is empty. Make sure that ItemsToSign is configured correctly." />

    <PropertyGroup Condition="$(_DotNetCoreRequired)">
      <_DotNetCorePath>$(DotNetTool)</_DotNetCorePath>
    </PropertyGroup>

    <!-- Keep TarToolPath TFM in sync with TarTool project TFM. -->
    <Microsoft.DotNet.SignTool.SignToolTask
        DryRun="$(_DryRun)"
        TestSign="$(_TestSign)"
        DoStrongNameCheck="$(DoStrongNameCheck)"
        AllowEmptySignList="$(AllowEmptySignList)"
        CertificatesSignInfo="@(CertificatesSignInfo)"
        ItemsToSign="@(ItemsToSign)"
        StrongNameSignInfo="@(StrongNameSignInfo)"
        FileSignInfo="@(FileSignInfo)"
        ItemsToSkip3rdPartyCheck="@(ItemsToSkip3rdPartyCheck)"
        FileExtensionSignInfo="@(FileExtensionSignInfo)"
        TempDir="$(ArtifactsTmpDir)"
        LogDir="$(ArtifactsLogDir)"
        DotNetPath="$(_DotNetCorePath)"
        SNBinaryPath="$(SNBinaryPath)"
        MicroBuildCorePath="$(NuGetPackageRoot)microsoft.visualstudioeng.microbuild.core\$(MicrosoftVisualStudioEngMicroBuildCoreVersion)"
        Wix3ToolsPath="$(WixInstallPath)"
        WixToolsPath="$(NuGetPackageRoot)microsoft.wixtoolset.sdk\$(MicrosoftWixToolsetSdkVersion)\tools\net472\x64"
        TarToolPath="$(NuGetPackageRoot)microsoft.dotnet.tar\$(MicrosoftDotNetTarVersion)\tools\$(NetToolCurrent)\any\Microsoft.Dotnet.Tar.dll"
        PkgToolPath="$(PkgToolPath)"
        RepackParallelism="$(SignToolRepackParallelism)"
        MaximumParallelFileSize="$(SignToolRepackMaximumParallelFileSize)"
        DotNetTimeout="$(SignToolDotNetTimeout)"
        MSBuildVerbosity="$(SignToolMSBuildVerbosity)" />
  </Target>

</Project>